ESET Uncorver Trojan Crypto Wallet Scheme Removes 13 Apps

ESET, a research cyber security firm has uncovered a “sophisticated scheme” that disseminates Trojan apps disguised as popular cryptocurrency wallets.

The harmful method targets mobile devices running on the Android or Apple (iOS) operating systems, which can be infected if the user installs a false program.

iexclusivenews reports that according to ESET’s research. Malicious programs impersonate real crypto wallets. Such as MetaMask, Coinbase, Trust Wallet, TokenPocket, Bitpie, imToken, and OneKey and are distributed through fraudulent websites.

The business also uncovered 13 malware apps on the Google Play Store that imitated the Jaxx Liberty wallet.

The offending apps, which had been downloaded over 1,100 times, have subsequently been removed by Google. But there are still many more hiding on other websites and social media platforms.

[the_ad id=”41664″]

The threat actors spread their wares using Facebook and Telegram groups with the goal of stealing crypto assets from its victims.

What You Need To Know

Since May 2021, ESET claims to have discovered “dozens of trojanized bitcoin wallet apps.”

It also noted that the plan, which it believes is the work of a single gang, was largely aimed at Chinese consumers using Chinese websites.

Other threat vectors, according to Luká tefanko, the researcher who deciphered the method, include delivering seed phrases to the attacker’s server across insecure connections, and adding:

[the_ad id=”41670″]

“This means that victims’ funds could be stolen not only by the operator of this scheme but also by a different attacker eavesdropping on the same network.”

Depending on where the phony wallet apps are installed, they operate differently.

It targets a new cryptocurrency that the user may not have traded before, encouraging the user to download the required wallet on Android.

On iOS, however, the apps must be downloaded using arbitrary trustworthy code-signing certificates in order to avoid Apple’s App Store.

This means that the user can have two wallets installed at the same time, one real and one Trojan. But this is less of a risk because most users rely on App Store verification for their apps.

[the_ad id=”41664″]

ESET advises cryptocurrency investors and traders to only install wallets from trusted sources that are linked to the official website of the exchange or company.

Google Cloud introduced the Virtual Machine Threat Detection (VMTD) technology in February, which checks for and detects “cryptojacking” malware that uses resources to mine digital currencies.

Cryptojacking accounted for 73% of the total value received by malware-related wallets and addresses between 2017 and 2021, according to a January Chainalysis research.